Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| XZ Utils backdoorcampaign | Uses | Axios supply chain attackmalware | — | Correlated cluster | 2026-08-21 |
| JWRcampaign | Uses | JSFuckmalware | — | Correlated cluster | 2026-09-14 |
| Information stealerscampaign | Uses | infostealermalware | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | Neo-reGeorgmalware | — | Correlated cluster | 2026-09-17 |
| PhantomCorecampaign | Uses | Oyster (CleanBoost)malware | — | Correlated cluster | 2026-08-25 |
| Qilin (fka Agenda) · Qilincampaign | Uses | AiLockmalware | — | Correlated cluster | 2026-09-25 |
| PromptSpycampaign | Uses | PromptSpymalware | — | Correlated cluster | 2026-09-03 |
| Qilin (fka Agenda) · Qilincampaign | Uses | INCmalware | — | Correlated cluster | 2026-09-25 |
| Trojanized PDF softwarecampaign | Uses | XG-Webmalware | — | Correlated cluster | 2026-08-17 |
| Qilin (fka Agenda) · Qilincampaign | Uses | Vidarmalware | — | Correlated cluster | 2026-09-25 |
| PowerShell-based RATcampaign | Uses | AnonyMousKITmalware | — | Correlated cluster | 2026-08-31 |
| AnyDeskcampaign | Uses | Toy Ghouls backdoormalware | — | Correlated cluster | 2026-09-17 |
| AnyDeskcampaign | Uses | SysReadSvc.dllmalware | — | Correlated cluster | 2026-09-17 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | DeepSeekmalware | — | Correlated cluster | 2026-09-16 |
| TeamPCP Cloud Stealercampaign | Uses | SHADOWLADDERmalware | — | Correlated cluster | 2026-09-02 |
| Qilin (fka Agenda) · Qilincampaign | Uses | ngrokmalware | — | Correlated cluster | 2026-09-25 |
| AnyDeskcampaign | Uses | RedExtmalware | — | Correlated cluster | 2026-09-17 |
| Ransomwarecampaign | Uses | Wormsmalware | — | Correlated cluster | 2026-09-02 |
| PowerShell-based RATcampaign | Uses | Qilin ransomwaremalware | — | Correlated cluster | 2026-08-31 |
| SPECTREcampaign | Uses | badsecretsmalware | — | Correlated cluster | 2026-08-20 |
| payload · XMRigcampaign | Uses | DotNetZip.dllmalware | — | Correlated cluster | 2026-09-03 |
| krybitactor | Claims to target | hccd-construction.comtarget | Unverified claim | Leak-site claim · ransomfeed | 2026-09-01 |
| apt73actor | Claims to target | dgcement.comtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-07-06 |
| Void Manticore (Storm-0842)actor | Claims to target | Contact Handalatarget | Unverified claim | Leak-site claim · ransomware.live | 2026-03-08 |
| BlackNevasactor | Claims to target | Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco...target | Unverified claim | Leak-site claim · ransomware.live | 2026-08-25 |
| Everestactor | Claims to target | Emirates Flight Cateringtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-07-17 |
| DireWolfactor | Claims to target | MCT Group of Companiestarget | Unverified claim | Leak-site claim · ransomware.live | 2026-08-21 |
| The Gentlemenactor | Claims to target | Avanta Maroc Ex Adeccotarget | Unverified claim | Leak-site claim · ransomware.live | 2026-08-14 |
| BlackNevasactor | Claims to target | OTEGROUPtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-08-01 |
| lockbit5actor | Claims to target | ssskwt.comtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-03-10 |
| IncRansomactor | Claims to target | Teknopres_TRtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-03-10 |
| The Gentlemenactor | Claims to target | SETCARtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-05-12 |
| DragonForceactor | Claims to target | A1 Capitaltarget | Unverified claim | Leak-site claim · ransomware.live | 2026-02-12 |
| lockbit5actor | Claims to target | gov.krdtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-02-28 |
| IncRansomactor | Claims to target | alupco.comtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-04-13 |
| DragonForceactor | Claims to target | Corniche Hotel Abu Dhabitarget | Unverified claim | Leak-site claim · ransomware.live | 2026-06-12 |
| payloadactor | Claims to target | SAYEGHtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-04-01 |
| Stormousactor | Claims to target | SA2000.COMtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-06-04 |
| apt73actor | Claims to target | moccae.gov.aetarget | Unverified claim | Leak-site claim · ransomware.live | 2026-04-27 |
| apt73actor | Claims to target | shj.aetarget | Unverified claim | Leak-site claim · ransomware.live | 2026-04-27 |
| apt73actor | Claims to target | 2m.matarget | Unverified claim | Leak-site claim · ransomware.live | 2026-04-27 |
| krybitactor | Claims to target | www.harputyapi.comtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-09-17 |
| krybitactor | Claims to target | www.kashkha.comtarget | Unverified claim | Leak-site claim · ransomfeed | 2026-09-13 |
| The Gentlemenactor | Claims to target | Arceliktarget | Unverified claim | Leak-site claim · ransomware.live | 2026-05-01 |
| Stormousactor | Claims to target | monoprix.tntarget | Unverified claim | Leak-site claim · ransomware.live | 2026-06-28 |
| Qilin (fka Agenda)actor | Claims to target | Black Cat Engineering Construction Wlltarget | Unverified claim | Leak-site claim · ransomware.live | 2026-08-30 |
| The Gentlemenactor | Claims to target | Nile Air Informationtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-02-13 |
| The Gentlemenactor | Claims to target | Meridian Logistics Grouptarget | Unverified claim | Leak-site claim · ransomfeed | 2026-08-22 |
| Void Manticore (Storm-0842)actor | Claims to target | Atlas Insurances Ltdtarget | Unverified claim | Leak-site claim · ransomware.live | 2026-03-05 |
| nightspireactor | Claims to target | DiamondLeasetarget | Unverified claim | Leak-site claim · ransomware.live | 2026-08-30 |